Alice’s Registry disappears down the rabbit hole

One of the oldest domain registrars appears to be on its way out.

San Francisco-based Alice’s Registry has been hit with a breach notice and termination warning by ICANN after apparently being incommunicado for over a year.

According to ICANN, they last spoke in August 2020, when AR indicated that it was thinking about “shutting down the registrar business”.

Since then, the web site has stopped working and ICANN can’t get through on the telephone.

The breach notice claims past-due fees and a failure to operate a working Whois service, and gives the registrar until November 1 to pay up or get its contract terminated.

Alice’s Registry is one of the oldest registrars, founded in 1999, but it’s never had more than a few thousand names under management. Its founder, Rick Wesson, has been involved in the ICANN community since pretty much the beginning.

Almost no security researchers asking for Whois records – Tucows

Security researchers are not asking for private Whois records in anywhere near the numbers you might have been led to believe, according to data released this week by Tucows.

The registrar revealed that it received just one request from the security community between September 2020 and the end of August 2021. That’s not even 1% of the total.

Over the same period, the “commercial litigators” category, presumably including intellectual property interests going after suspected cybersquatters, were behind 87% of requests.

About 9% of requests came from law enforcement agencies, Tucows said.

The company said that it disclosed private registrant data in 74% of cases. It denied the requests in 9% of cases. Other requests were incomplete or abandoned.

Tucows has been offering a Tiered Access service for its Whois records since the General Data Protection Regulation came into effect in May 2018. It has received 4,478 requests since then.

Cloudflare goes all-in with at-cost domains

Content delivery specialist Cloudflare has come out as a fully-fledged domain name registrar, promising to sell names in hundreds of TLDs with no markup on the registry wholesale price.

Since the company launched Cloudflare Registrar three years ago, it’s only been possible for customers to transfer in their domains from other registrars; no new regs were possible.

That’s now changed, with the company today announcing customers can buy their domains direct without having to faff about with transfers.

“It’s important to note that our registrar pricing is ‘at-cost.’ That means we charge our customers exactly what we pay the registry, plus any applicable ICANN transaction fees,” the company blogged.

A new .com costs $8.57, for example.

It appears that you need to be a Cloudflare CDN customer to use the registrar service, but it offers a free plan among its suite of offerings.

It’s not the only registrar to offer names at cost, but it’s certainly the one with the best brand recognition.

Cloudflare currently offers over 250 TLDs, and plans to launch 40 more next month. It just added .uk, and plans to add more ccTLDs, as well as premium-priced domains, in future.

The company had about 325,000 domains under management at the last count in May, having transferred a net of 118,000 names during the previous 12 months.

Make no mistake, Cloudflare will be losing money on this venture, despite what it said in September 2018, when it made out running a registrar was cost-free.

Could registrars get sued under new Texas abortion law?

Does the controversial new Texas state legislation effectively banning most abortions pose legal risks for domain name registries and registrars?

The so-called Texas Heartbeat Act, or SB 8, came into effect at the start of the month. It bans abortions in Texas when doctors can detect a heartbeat in the fetus, which is usually about six weeks after conception, when most women don’t know they’re pregnant.

In an apparent attempt to circumvent the US Supreme Court’s oversight, the enforcement of the law is left to civil actions — the cops won’t come to get you, but any US citizen will be allowed to file civil suits with a guaranteed payout of at least $10,000 if they win and no risk of paying court costs if they lose.

The ban extends not only to doctors who perform the procedure, but also those who “aid and abet”.

This part of the law has been written in such a way that it’s been broadly interpreted as even opening up taxi drivers who transport patients to abortion clinics to possible liability.

Taxi service giants Uber and Lyft have both already announced they will cover the costs of any legal representation their contractors need.

So if taxi drivers can get sued, why not also registrars and hosting companies? Clinics, counselling services and the like all need web sites, and web sites need domains.

It might be a stretch, and the law is worded in such a way that could give registrars a defense, saying liability is restricted to those who “knowingly engages in conduct that aids or abets the performance or inducement of an abortion”.

“Knowingly” is a key word. Taxi drivers dropping off a woman at a clinic know where they are driving. Registrars and hosting companies typically don’t know what is being hosted on their servers.

But what if they are told about pro-abortion content on their services, accompanied by a threat of litigation?

It seems that so far the registrar industry, even one company headed by a right-wing religious individual, are effectively, if not vocally, on the pro-choice side of the debate.

A “whistleblower” web site, run by Texas Right to Life at prolifewhistleblower.com, that was inviting users to essentially “doxx” abortion providers has been kicked off GoDaddy for violating its privacy rules, and even right-leaning Epik has asked the registrant to leave on similar grounds.

DropCatch raises antitrust concerns about Donuts’ Dropzone proposal

TurnCommerce, the company behind DropCatch.com and hundreds of accredited domain name registrars, reckons Donuts’ proposed Dropzone service would be anticompetitive.

Company co-founder Jeff Reberry has written to ICANN to complain that Dropzone would introduce new fees to the dropping domains market, raising the costs involved in the aftermarket.

He also writes that Donuts’ ownership of Name.com, a registrar that DropCatch competes with in the drop market, would have an “unfair competitive advantage” if Dropzone is allowed to go ahead:

Donuts is effectively asking every entity in the ICANN ecosystem to bear the costs of introducing a new service with no benefit outside of a financial benefit to itself, while forcing all registrars to spend more money and resources to register available domain names.

Donuts is proposing Dropzone across its whole portfolio of 200+ gTLDs. It’s a parallel registry infrastructure that would exist just to handle dropping domains in more orderly fashion.

Today, companies such as TurnCommerce own huge collections of shell registrars that are used to ping registries with EPP Create commands around the time valuable domains are going to delete.

Under Dropzone, they’d instead submit create requests with the Dropzone service, and Donuts would give out the rights to register the domains in question on a first-come, first-served basis.

While ICANN had approved a similar request from Afilias before it was acquired by Donuts, the Dropzone proposed by Donuts has one major difference — it proposes a new fee for accessing the system.

No details about this fee have been revealed, which has TurnCommerce nervous.

Donuts is asking for Dropzone via the Registry Services Evaluation Process and ICANN has not yet approved it.

Reberry says ICANN should consult with the relevant governmental competition authorities before it approves the proposal.

You can read Reberry’s letter here (pdf) and our original article about Dropzone here.

NameSilo says it’s growing too fast to be acquired

NameSilo Technologies has called off talks to sell its registrar, also called NameSilo, saying the company is growing too fast to exit right now.

The Canadian company grew its domains under management by 578,000 between April 2020 and April this year, when it stood at 3.9 million domains. It says it has since crossed 4.3 million.

The prospective deal, with Dutch acquisition vehicle WGH Holdings was announced last December.

But NameSilo’s CEO Paul Andreola said in a press release:

We believe that the value of Namesilo has grown significantly since the discussions with the prospective buyer began and feel that there is more value to be unlocked over the near to medium term for shareholders.

At the same time, the company reported revenue of $8.4 million for the second quarter, up $900,000 on the same period last year, with adjusted EBITDA of $435,344.

Bookings were up to $9.9 million from $7.6 million.

It was the company’s debt that first spurred acquisition talks. NameSilo says that debt has been reduced from $4.7 million to $3.85 million since March.

Most registrars fail ICANN abuse audit

The large majority of accredited registrars failed an abuse-related audit at the first pass, according to ICANN.

(UPDATE October 14, 2021: ICANN disagrees with this characterization.)

The audit of 126 registrars, representing over 90% of all registered gTLD domains, founds that 111 were “not fully compliant with the [Registrar Accreditation Agreement’s] requirements related to the receiving and handling of DNS abuse reports”.

Only 15 companies passed with flying colors, ICANN said.

A further 92 have already put in place changes to address the identified concerns, with 19 more still struggling to come into compliance.

The particular parts of the RAA being audited require registrars to publish an abuse email address that it monitored 24/7 and to take action on well-founded cases of abuse within 24 hours of notification.

The results of the audit, carried out by ICANN Compliance and KPMG, can be found here (pdf).

Registrars to get more domain takedown powers

ICANN will soon grant its accredited registrars the ability to unilaterally take down domains involved in ongoing security incidents, according to chair Maarten Botterman.

Responding to the news that registries have come up with a voluntary framework for tackling botnets that auto-generate domain registrations for use in command and control activities, Botterman said ICANN will extend a process currently restricted to registries into the registrar community.

That policy is the Expedited Registry Security Request Process, which allows registries to quickly obtain a retroactive waiver of its contractual obligations — such as the obligation to pay ICANN fees — if it has to urgently respond to a major incident.

The process was invoked four times last year, covering six gTLDs and roughly 1,600 domains. ICANN granted all four requests, though it seems to have on average missed its target of responding within three business days.

“As part of ICANN’s efforts to support the mitigation of DNS security threats, ICANN org will soon enable registrars to also request such waivers,” Botterman recently told the Registries Stakeholder Group.

He was responding to the news that several registries have signed up to a voluntary “Framework on Domain Generating Algorithms (DGAs) Associated with Malware and Botnets”.

That framework would allow registries to preemptively register or block domains likely to be auto-generated by botnet code, thereby cutting the head off the snake before it can wreak more havoc.

MMX drops two registrars

MMX has dumped two registrar contracts with ICANN, as the company’s asset-sale to GoDaddy nears completion.

ICANN records show that Minds and Machines LLC and Minds and Machines Registrar UK Limited both entered “terminated” status over the last few days, meaning they’re no longer accredited to sell gTLD domains.

But they weren’t doing any selling of domains anyway. The UK company had 108 domains under management and the US on had none at the last count.

The US accreditation was the one used primarily by the company under its original business model of a “triple-play” registry/registrar/back-end, when it was still going by Minds + Machines, which was abandoned five years ago.

The registrar peaked at about 50,000 names, which were then transferred over to Uniregistry. The back-end business was also abandoned, with Nominet taking over technical management of most of its gTLDs.

MMX is currently in the process of getting out of its sole remaining third business, that of gTLD registry.

GoDaddy has already taken over most of its 27 gTLDs under a $120 million deal announced earlier this year. Four TLDs remain, and will be transferred subject to approval from government partners.

Domainers at risk as EnCirca takes over deadbeat registrar’s customer base

Customers of defunct registrar Pheenix risk losing their domains because the company was not properly escrowing its registrant data, according to the registrar taking over their domains.

EnCirca, which is taking over up to 6,000 domains previously registered with Pheenix, says the registrar’s shoddy escrow practices mean some of these domains may not be reunited with their rightful owners.

Pheenix “failed to properly escrow domain ownership information for many of the domains utilizing WHOIS proxy services”, EnCirca recently wrote, adding:

We anticipate that many domains will remain unclaimed due to bounced emails or inoperable proxy services. Locating rightful owners will be problematic since the data escrow is often devoid of any identifying ownership information.

To try to mitigate the problem, EnCirca is offering affected registrants the chance to prove ownership by filling out a form and uploading other evidence, such as Pheenix receipts or bank statements.

EnCirca added that because Pheenix disappeared still owing money to registries, the registries may be forcing renewal or restore fees that will then be passed on registrants.

If your domains were at or near expiration, restoring them could be complex and pricey or impossible.

If you’re affected, you can find information here.

Most or all Pheenix customers are likely to be domain investors. It was a drop-catcher, which once had over 500 dummy registrars in its expansive dropnet, most of which it subsequently de-accredited.

But it went AWOL last May, not responding to ICANN or paying its dues, apparently disappearing from the face of the Earth.

ICANN terminated its accreditation in May this year, and initiated a bulk transfer to EnCirca a couple weeks ago (which it only disclosed this week).

EnCirca has experience handling this kind of problem, which is presumably why ICANN gifted it the bulk transfer. In 2018 it took on the domains 49 of Pheenix’s shell registrars, which it says were suffering from the same escrow problems.